mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-08 16:21:32 +00:00
72 lines
2.9 KiB
Markdown
72 lines
2.9 KiB
Markdown
# Interpreting output
|
|
|
|
See the [status_screen.md](status_screen.md) file for information on
|
|
how to interpret the displayed stats and monitor the health of the process. Be
|
|
sure to consult this file especially if any UI elements are highlighted in red.
|
|
|
|
The fuzzing process will continue until you press Ctrl-C. At a minimum, you want
|
|
to allow the fuzzer to complete one queue cycle, which may take anywhere from a
|
|
couple of hours to a week or so.
|
|
|
|
There are three subdirectories created within the output directory and updated
|
|
in real-time:
|
|
|
|
- queue/ - test cases for every distinctive execution path, plus all the
|
|
starting files given by the user. This is the synthesized corpus
|
|
mentioned in section 2.
|
|
|
|
Before using this corpus for any other purposes, you can shrink
|
|
it to a smaller size using the afl-cmin tool. The tool will find
|
|
a smaller subset of files offering equivalent edge coverage.
|
|
|
|
- crashes/ - unique test cases that cause the tested program to receive a
|
|
fatal signal (e.g., SIGSEGV, SIGILL, SIGABRT). The entries are
|
|
grouped by the received signal.
|
|
|
|
- hangs/ - unique test cases that cause the tested program to time out. The
|
|
default time limit before something is classified as a hang is
|
|
the larger of 1 second and the value of the -t parameter.
|
|
The value can be fine-tuned by setting AFL_HANG_TMOUT, but this
|
|
is rarely necessary.
|
|
|
|
Crashes and hangs are considered "unique" if the associated execution paths
|
|
involve any state transitions not seen in previously-recorded faults. If a
|
|
single bug can be reached in multiple ways, there will be some count inflation
|
|
early in the process, but this should quickly taper off.
|
|
|
|
The file names for crashes and hangs are correlated with the parent, non-faulting
|
|
queue entries. This should help with debugging.
|
|
|
|
When you can't reproduce a crash found by afl-fuzz, the most likely cause is
|
|
that you are not setting the same memory limit as used by the tool. Try:
|
|
|
|
```shell
|
|
LIMIT_MB=50
|
|
( ulimit -Sv $[LIMIT_MB << 10]; /path/to/tested_binary ... )
|
|
```
|
|
|
|
Change LIMIT_MB to match the -m parameter passed to afl-fuzz. On OpenBSD,
|
|
also change -Sv to -Sd.
|
|
|
|
Any existing output directory can be also used to resume aborted jobs; try:
|
|
|
|
```shell
|
|
./afl-fuzz -i- -o existing_output_dir [...etc...]
|
|
```
|
|
|
|
If you have gnuplot installed, you can also generate some pretty graphs for any
|
|
active fuzzing task using afl-plot. For an example of how this looks like,
|
|
see [https://lcamtuf.coredump.cx/afl/plot/](https://lcamtuf.coredump.cx/afl/plot/).
|
|
|
|
You can also manually build and install afl-plot-ui, which is a helper utility
|
|
for showing the graphs generated by afl-plot in a graphical window using GTK.
|
|
You can build and install it as follows
|
|
|
|
```shell
|
|
sudo apt install libgtk-3-0 libgtk-3-dev pkg-config
|
|
cd utils/plot_ui
|
|
make
|
|
cd ../../
|
|
sudo make install
|
|
```
|